hardMultiple ChoiceObjective-mapped
MLA-C01 Practice Question: Using a SageMaker notebook instance to develop…
A company is using a SageMaker notebook instance to develop models. The security team requires that all data in the notebook be encrypted at rest and in transit, and that internet access be restricted. Which configuration meets these requirements?
⚠ Common exam trap
Watch out — candidates often assume that blocking inbound traffic (Option A or B) is sufficient to restrict internet access, but they overlook that outbound internet access must also be explicitly disabled, and that encryption-at-rest requires a customer-managed KMS key, not just any encryption key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPC-only notebook instance with a customer-managed KMS key and disable direct internet access.
A VPC-only SageMaker notebook instance ensures that all network traffic stays within the customer's VPC, and disabling direct internet access prevents any outbound internet connectivity. Using a customer-managed KMS key for EBS encryption meets the encryption-at-rest requirement, while SageMaker automatically encrypts data in transit using TLS 1.2 within the VPC, satisfying both security mandates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a notebook with internet access enabled but attach a security group that blocks all outbound traffic.
Why it's wrong here
Internet access enabled allows metadata service; blocking outbound may break SageMaker API calls.
- ✗
Use a notebook with a public subnet and a network ACL that denies all inbound traffic.
Why it's wrong here
Public subnet implies internet gateway, violating no internet access.
- ✗
Use a VPC-only notebook with default AWS managed key for EBS encryption.
Why it's wrong here
Default AWS managed key does not satisfy customer-managed encryption requirements.
- ✓
Use a VPC-only notebook instance with a customer-managed KMS key and disable direct internet access.
Why this is correct
VPC-only blocks internet, KMS encrypts at rest, HTTPS encrypts in transit.
Go deeper
Related to this question
About these practice questions
One of 835 original MLA-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MLA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MLA-C01 exam.